Trellix Helix with GenAI

We use routing and switches, IP phones, routers, switches, and a core switch. We also have Identity Services Engine, but it is end of life or end of support now, so we are working on replacing it.

Our solutions cut across various security products from Sophos and Trellix. We started with McAfee for 15 years and have now transitioned to Trellix, which acquired McAfee.

Basically, we use this to protect our endpoints.

Trellix Endpoint Detection and Response (EDR)  does everything. It saves time, it saves money, and of course, it provides peace of mind. Anytime management wants any report, we can generate it automatically and push it. This is quite effective.

First, it is user-friendly. Second, it works with a lot of products and many different versions of Windows. Third, the reporting module is very good. Because if you are using Endpoint Protection with ePO, it has a central console that is quite easy to manage all endpoints at a single dashboard. It has very good threat intelligence.

In addition to the threat intelligence, it is easy to manage and granular. We can easily manage products up to the client level, and we know what is happening, then we do a lot of threat analysis. There are many resources that we can use. They also have very good support.

Trellix Endpoint Detection and Response (EDR)  has very good threat hunting capability. We can use the logs to see when a process starts and what it hits, and the other processes or services it has affected. This is quite encouraging.

They can enhance Trellix Endpoint Detection and Response (EDR) using AI now to do more enhanced reporting and more enhanced threat analysis. There are some client task assignments and policies that should be automatically automated with AI with a click of a button. They should introduce AI and do a lot of things.

We have used this for 16 years. All this information, how can we protect it? Are we covered by the GDPR regulation?

Initially, I was using it on servers, but it consumes a lot of resources on servers. So I have to use Sophos XDR  on servers because Sophos XDR  does not consume resources. That is the difference.

We do a lot of research. Our only problem with Trellix is that it is resource intensive and takes a lot of resources. However, we found out that it works on our systems and on our desktops. But on our servers, we do not want it to touch our resources, so we deployed Sophos XDR on the server.

It is straightforward. The only little challenge is that you have to get all the necessary updates for it to connect to the database.

I am using on-premises with the ePolicy Orchestrator  and then we apply the license. After the product is already installed, we do the necessary upgrade, restart the system, and then push the agents to the endpoints. Then we receive updates and manage our clients.

We have partners that provide Trellix Endpoint Detection and Response (EDR), so we work with them to deploy.

It is quite reasonable.

For network troubleshooting, I moved to security now and I am not in network, but I think they are using Cisco product too for that.

We are in the energy market, specifically in energy generation. We got the Trellix EDR installed in most endpoints.

The tool helps us to traverse possible thread incidents thru our mult site network infrastructure. In case of any forensic case it will be helpful to hunt thru the history or evidence information the EDR collects.

Trellix Endpoint Detection and Response (EDR)  is valuable because we have a Wide Area Network with many sites, and the EDR is cross-site since it is configured and managed from the cloud. This is very useful because it does not matter what is happening at one endpoint of the company in one site and the relation of an incident with another computer or endpoint at another site. All the tree of data that we have, which may be a lot of information help us to argue whether it is going to be a threat or not, can be analyzed. Most of the threats are not really threats, but we can see what is happening in the relations, in the networking, and the data that comes back and forth through our company's network infrastructure.

Threat hunting is valuable because it pinpoints what is happening everywhere in our networking infrastructure. We have a company contract working through a NOC- network operating center 24 hours a day. They are sending us reports many times a day if any threat is arising or asking why this operation has come through or if it is valid or not, or whether we have approved it. We have a lot of that type of information, but we need to manage the contract in a much more efficient way because I do not have the time to read the many information that comes through the network operating center, the security operating center, or the tools itself and the notification reports that I have. While I am managing the policies and the standards, I need a lot of people to monitor, detect, and recover if something happens. The tools are not useful for that. We need to have people with enough expertise to manage all of this.

I believe this is a product in evolution. I do not think it is a final tool to conduct forensics or information forensics of the incidents or information incidents that could arise in our network infrastructure. Trellix Endpoint Detection and Response (EDR)  is interesting and is a very good entry point that has been evolving through the last years. In the next two months, I have a new contract, and we are pointing out to have an XDR  solution with NDR and EDR together.

I do not have enough time to do it because I am the manager. However, my coworkers do not understand it yet. I have a contract with a third-party company that is making reports around that, but also they do not have enough experience or enough utility of this.

It would be interesting if I have a notification system from EDR. For example, if I am the manager, it would be interesting to have a warning, alarm, or something around that which could call me to get into the system and the dashboard to see what is happening. For example, if it is a high-level threat. However, most of them are just advisory or warnings. I do not enter the tool frequently. I guess I access it once every three months.

I have been using Trellix Endpoint Detection and Response (EDR) for about six years.

As mentioned, this is an evolutionable tool. In the past there has been many times when the tool clogged the endpoints and we had to uninstall it. Windows (c) 10 enterprise edition, for instance, has some problems.

I have not scalate the EDR solution yet. We have not had a critical alert to do it. It's supossed that the SOC company should do it just in the case.

Tech support may be tricky if the support comes from Asia experts. Eeryone here speaks spanish and I are not affordable most of time. The tech is interesting when a high support level is called. Once someone from Argentina helped me that has excellent skills. We need more like her.

No other EDR solutions.

I guess it was complex. To get the EDR operating useful I had to wait around 2 years.

Bafing from Peru is an integrator and consultant. They had done all of the work, and accompanied us many years.

Of course this is a yes. I had called the US partner during the past years when I need the support directly from the manufacturer and I got all the help to workaround or overcame issues. That had happended when my local partner company was not enough.

I pay for what we get. But the service level from my partner company is not enough to overcome a complex case.

We are a gobernment company, so we ask the system to contract a company that is resourceful with cybersecurity withount mentioning the name or mark. We had been using Trellix since it was Mc Afee. But I had evaluated solutions from Microsoft, Panda, ESNET, as general malware tools.

This year, I am planning to have a training for all the personnel of the company in every department so they can learn the basics of the endpoint tool. They can have more actions for possible threats or everything so they can help my department to make a better and faster action if something real is happening. Something like ethical hacking or a service, but using my own personnel in the company. I know that it is difficult, but I want to try to make that this year.

I have evaluated many products including Fortinet environment and a lot of appliances, and also many other products that we have now. I have evaluated around six or seven other brands or other products. However, I have learned Trellix Endpoint Detection and Response (EDR) tools and before that McAfee, around two decades. It is enough expertise that we have made. I do not want to lose that with maybe another interesting tool. For example, what would be interesting is if an XDR  tool that can help us in managing the threats of the cybersecurity environment uses AI as an agent, a trained agent that helps our department, so it has to be trained first by a company like Trellix or another with the expertise or the capacity to help us actually. That is one thing I can recommend.

In February or March, I am signing a new contract with five levels, three more levels of security that we have now. We will have the tool, the SOC, the operating center service, and we need to manage applications firewall, web filtering, and XDR, and maybe next year also PAM and so on. I rated this solution an 8 out of 10.

I use César for our endpoints, our users, and the services from email and web services, back and forth, and also at the edge of our network. We have contracted firewalls and everything else for networking.

The product and the services we have are quite good. However, I cannot stay at this level forever. I have to improve continuously and dynamically.

Everything is working, and the company is training its personnel. I have had in a few months in the past some attacks on personnel—so phishing, for example. I have spent efforts on training our managers and others - what can software do if the knowledge base is low?

This year, I am going to improve some tools to be installed or maybe acquire some services to better manage our web services and work with my coworkers.

Application fiber also needs attention. Nowadays I am making applications that are publicly seen on the Internet. I need some protection, possibly multi-factor authentication improvements. I am seeing, for workflows, some sort of ethical hacking to test our environment.

Knowledge of everything, not only the product - maybe some kind of alerts - needs to emerge. I see the current ones as very low-tier, and they must improve.

I have used Trellix for some years.

I haven't had any issues. The pricing is very fine and according to the service. Trellix has done a good job reducing threats.

I have spent a lot of time with this product. I have contracted support and also have an operating control so I can get various types of support.

I have used Trellix for some years. In the past, the EDR was McAfee. I have worked with it for around 20 years.

The initial setup is a hard issue.

I have two contractors that help me support the infrastructure here. One is at the edge of networking, and the other is in the endpoints of our company.

I don't have any return on this investment. This is just a security policy for everything.

I haven't had any really great problems with pricing in the past two or three years.

Maybe another level of product and support from manufacturers would be better.

I have seen companies without any EDR services, and we were lacking information. I started with IDR around four years ago, and the support services were very light. I remember doing many tickets for Trellix support, and my EDR was not properly functioning. I didn't feel the detection or the real protection. My company is one among 17 others that are part of a corporation. I am a member of the IT Security Council.

Overall product rating is five out of ten.